Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

contain: fail closed when setsid fails

Browse Source
This commit is contained in:
Darren Carreras
2026-08-27 12:47:15 -04:00
committed by Darren Carreras
parent 44e08fd4e5
commit 660c20d237
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@@ -171,6 +171,8 @@ test: $(BIN) $(TEST_BINS) test-cmdline
ifeq ($(UID),0) ifeq ($(UID),0)
$(call run_test, setpriv --reuid 1000 --regid 1000 --groups 1234 -- ./nsjail -q -Mo --user 65534 --group 65534 --disable_clone_newnet --disable_clone_newcgroup --disable_clone_newns --disable_clone_newpid --disable_clone_newipc --disable_clone_newuts --disable_proc -- /bin/true, 255) $(call run_test, setpriv --reuid 1000 --regid 1000 --groups 1234 -- ./nsjail -q -Mo --user 65534 --group 65534 --disable_clone_newnet --disable_clone_newcgroup --disable_clone_newns --disable_clone_newpid --disable_clone_newipc --disable_clone_newuts --disable_proc -- /bin/true, 255)
$(call run_test, setpriv --reuid 1000 --regid 1000 --clear-groups -- ./nsjail -q -Mo --user 65534 --group 65534 --disable_clone_newnet --disable_clone_newcgroup --disable_clone_newns --disable_clone_newpid --disable_clone_newipc --disable_clone_newuts --disable_proc -- /bin/true, 0) $(call run_test, setpriv --reuid 1000 --regid 1000 --clear-groups -- ./nsjail -q -Mo --user 65534 --group 65534 --disable_clone_newnet --disable_clone_newcgroup --disable_clone_newns --disable_clone_newpid --disable_clone_newipc --disable_clone_newuts --disable_proc -- /bin/true, 0)
$(call run_test, setsid --fork --wait ./nsjail -q -Me --disable_clone_newuser --disable_clone_newnet --disable_clone_newcgroup --disable_clone_newns --disable_clone_newpid --disable_clone_newipc --disable_clone_newuts --disable_proc --chroot / -- /bin/true, 0)
$(call run_test, strace -f -qq -e inject=setsid:error=EPERM ./nsjail -q -Me --disable_clone_newuser --disable_clone_newnet --disable_clone_newcgroup --disable_clone_newns --disable_clone_newpid --disable_clone_newipc --disable_clone_newuts --disable_proc --chroot / -- /bin/true, 255)
endif endif
$(call run_test, ./nsjail -q -Mo --chroot / --user 99999 --group 99999 -- /bin/true < /tmp, 255) $(call run_test, ./nsjail -q -Mo --chroot / --user 99999 --group 99999 -- /bin/true < /tmp, 255)
$(call run_test, ./nsjail -q -Mo --chroot / --user 99999 --group 99999 --pass_fd 0 -- /bin/true < /tmp, 0) $(call run_test, ./nsjail -q -Mo --chroot / --user 99999 --group 99999 --pass_fd 0 -- /bin/true < /tmp, 0)

11
contain.cc
View File

@@ -147,7 +147,16 @@ static bool containPrepareEnv(nsj_t* nsj, int parent_fd, pid_t expected_parent)
PLOG_W("setpriority(%d)", nsj->njc.nice_level()); PLOG_W("setpriority(%d)", nsj->njc.nice_level());
} }
if (!nsj->njc.skip_setsid()) { if (!nsj->njc.skip_setsid()) {
setsid(); if (setsid() == -1) {
const int saved_errno = errno;
if (saved_errno == EPERM && getsid(0) == getpid()) {
LOG_D("Process is already a session leader (SID == PID)");
} else {
errno = saved_errno;
PLOG_E("setsid()");
return false;
}
}
} }
return true; return true;
} }